@stewardhq/sdk 0.1.0-rc.0

package/dist/webhook/web.d.ts

@@ -0,0 +1,17 @@
+import { a as HeaderSource, c as VerifyRawOptions, i as HEADER_TIMESTAMP, l as VerifyRawResult, n as HEADER_EVENT_ID, o as VerifyFailure, r as HEADER_SIGNATURE, s as VerifyRawFailure, t as DEFAULT_TOLERANCE_SECONDS, u as VerifyResult } from "../_chunks/webhook-core.js";
+//#region ../contract/src/webhook-web.d.ts
+export declare function computeSignature(secret: string, eventId: string, timestamp: number, rawBody: string): Promise<string>;
+/** Gönderen tarafı: teslimat başlıkları. `secrets[0]` güncel sır. */
+export declare function signWebhook(secrets: readonly string[], eventId: string, rawBody: string, timestamp?: number): Promise<Record<string, string>>;
+/** Alıcı tarafı, şemasız: `./webhook`'taki `verifyWebhookRaw`'ın async karşılığı. */
+export declare function verifyWebhookRaw(secrets: readonly string[], headers: HeaderSource, rawBody: string, options?: VerifyRawOptions): Promise<VerifyRawResult>;
+/** Alıcı tarafı: imzayı ham gövde üzerinde doğrular, SONRA sözleşmeyle parse eder. */
+export declare function verifyWebhook(input: {
+  secrets: readonly string[];
+  headers: HeaderSource;
+  rawBody: string;
+  nowSeconds?: number;
+  toleranceSeconds?: number;
+}): Promise<VerifyResult>;
+//#endregion
+export { DEFAULT_TOLERANCE_SECONDS, HEADER_EVENT_ID, HEADER_SIGNATURE, HEADER_TIMESTAMP, type VerifyFailure, type VerifyRawFailure, type VerifyRawOptions, type VerifyRawResult, type VerifyResult, type HeaderSource as WebhookHeaders };

package/dist/webhook/web.js

@@ -0,0 +1,66 @@
+import { a as checkHeaders, i as HEADER_TIMESTAMP, n as HEADER_EVENT_ID, o as parseVerified, r as HEADER_SIGNATURE, s as signedPayload, t as DEFAULT_TOLERANCE_SECONDS } from "../_chunks/webhook-core.js";
+//#region ../contract/src/webhook-web.ts
+const encoder = new TextEncoder();
+const SHA256_BYTES = 32;
+function hmacKey(secret) {
+	const raw = secret.length === 0 ? /* @__PURE__ */ new Uint8Array(1) : encoder.encode(secret);
+	return crypto.subtle.importKey("raw", raw, {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign", "verify"]);
+}
+function toHex(bytes) {
+	return Array.from(new Uint8Array(bytes), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function fromHex(hex) {
+	if (hex.length !== 64 || !/^[0-9a-f]+$/.test(hex)) return null;
+	const out = new Uint8Array(SHA256_BYTES);
+	for (let i = 0; i < SHA256_BYTES; i++) out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+	return out;
+}
+async function computeSignature(secret, eventId, timestamp, rawBody) {
+	const key = await hmacKey(secret);
+	return toHex(await crypto.subtle.sign("HMAC", key, encoder.encode(signedPayload(eventId, timestamp, rawBody))));
+}
+/** Gönderen tarafı: teslimat başlıkları. `secrets[0]` güncel sır. */
+async function signWebhook(secrets, eventId, rawBody, timestamp = Math.floor(Date.now() / 1e3)) {
+	if (secrets.length === 0) throw new Error("en az bir imza sırrı gerekli");
+	const signatures = await Promise.all(secrets.map((s) => computeSignature(s, eventId, timestamp, rawBody)));
+	return {
+		[HEADER_EVENT_ID]: eventId,
+		[HEADER_TIMESTAMP]: String(timestamp),
+		[HEADER_SIGNATURE]: signatures.map((s) => `v1=${s}`).join(",")
+	};
+}
+/** Alıcı tarafı, şemasız: `./webhook`'taki `verifyWebhookRaw`'ın async karşılığı. */
+async function verifyWebhookRaw(secrets, headers, rawBody, options = {}) {
+	const checked = checkHeaders(secrets, headers, options);
+	if (!checked.ok) return checked;
+	const { eventId, timestamp, signatures } = checked;
+	const given = signatures.map(fromHex).filter((s) => s !== null);
+	if (given.length > 0) {
+		const data = encoder.encode(signedPayload(eventId, timestamp, rawBody));
+		for (const secret of secrets) {
+			const key = await hmacKey(secret);
+			for (const signature of given) if (await crypto.subtle.verify("HMAC", key, signature, data)) return {
+				ok: true,
+				eventId,
+				timestamp
+			};
+		}
+	}
+	return {
+		ok: false,
+		reason: "bad_signature"
+	};
+}
+/** Alıcı tarafı: imzayı ham gövde üzerinde doğrular, SONRA sözleşmeyle parse eder. */
+async function verifyWebhook(input) {
+	const verified = await verifyWebhookRaw(input.secrets, input.headers, input.rawBody, {
+		...input.nowSeconds !== void 0 ? { now: input.nowSeconds } : {},
+		...input.toleranceSeconds !== void 0 ? { toleranceSeconds: input.toleranceSeconds } : {}
+	});
+	return verified.ok ? parseVerified(verified.eventId, input.rawBody) : verified;
+}
+//#endregion
+export { DEFAULT_TOLERANCE_SECONDS, HEADER_EVENT_ID, HEADER_SIGNATURE, HEADER_TIMESTAMP, computeSignature, signWebhook, verifyWebhook, verifyWebhookRaw };

package/dist/webhook.d.ts

@@ -0,0 +1,3 @@
+import { a as HeaderSource, c as VerifyRawOptions, i as HEADER_TIMESTAMP, l as VerifyRawResult, n as HEADER_EVENT_ID, o as VerifyFailure, r as HEADER_SIGNATURE, s as VerifyRawFailure, t as DEFAULT_TOLERANCE_SECONDS, u as VerifyResult } from "./_chunks/webhook-core.js";
+import { i as verifyWebhookRaw, n as signWebhook, r as verifyWebhook, t as computeSignature } from "./_chunks/webhook.js";
+export { DEFAULT_TOLERANCE_SECONDS, HEADER_EVENT_ID, HEADER_SIGNATURE, HEADER_TIMESTAMP, type VerifyFailure, type VerifyRawFailure, type VerifyRawOptions, type VerifyRawResult, type VerifyResult, type HeaderSource as WebhookHeaders, computeSignature, signWebhook, verifyWebhook, verifyWebhookRaw };

package/dist/webhook.js

@@ -0,0 +1,3 @@
+import { i as HEADER_TIMESTAMP, n as HEADER_EVENT_ID, r as HEADER_SIGNATURE, t as DEFAULT_TOLERANCE_SECONDS } from "./_chunks/webhook-core.js";
+import { i as verifyWebhookRaw, n as signWebhook, r as verifyWebhook, t as computeSignature } from "./_chunks/webhook.js";
+export { DEFAULT_TOLERANCE_SECONDS, HEADER_EVENT_ID, HEADER_SIGNATURE, HEADER_TIMESTAMP, computeSignature, signWebhook, verifyWebhook, verifyWebhookRaw };

package/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "@stewardhq/sdk",
+  "version": "0.1.0-rc.0",
+  "description": "Steward SDK: contract schemas, typed API client and webhook signing.",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/z9cloud/steward.git",
+    "directory": "sdk"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./contract": {
+      "types": "./dist/contract.d.ts",
+      "default": "./dist/contract.js"
+    },
+    "./webhook": {
+      "types": "./dist/webhook.d.ts",
+      "default": "./dist/webhook.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "default": "./dist/server.js"
+    },
+    "./webhook/web": {
+      "types": "./dist/webhook/web.d.ts",
+      "default": "./dist/webhook/web.js"
+    },
+    "./testing": {
+      "types": "./dist/testing.d.ts",
+      "default": "./dist/testing.js"
+    },
+    "./testing/fixtures/events/*": "./dist/testing/fixtures/events/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org",
+    "provenance": true
+  },
+  "dependencies": {
+    "zod": "^4.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.13.3",
+    "tsdown": "^0.23.0",
+    "typescript": "^5.9.0",
+    "vitest": "^3.0.0",
+    "workerd": "^1.20260916.1",
+    "@z9cloud/steward-contract": "0.2.0"
+  },
+  "scripts": {
+    "build": "tsdown && node scripts/check-dist.mjs",
+    "check:pack": "node scripts/check-pack.mjs",
+    "check:workerd": "node scripts/check-workerd.mjs",
+    "test": "pnpm run build && vitest run",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src scripts tsdown.config.ts"
+  }
+}